General

  • Target

    http://62.204.41.121/lend/buildppb.exe

  • Sample

    230118-ll9easeb79

Score
10/10

Malware Config

Extracted

Family

aurora

C2

85.209.135.29:8081

Targets

    • Target

      http://62.204.41.121/lend/buildppb.exe

    Score
    10/10
    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

MITRE ATT&CK Enterprise v6

Tasks